One billion fake emails and texts since January: Microsoft goes after a Chinese-speaking phishing network

A fine to pay, a message from a delivery company, an alert from your bank. According to Microsoft, more than a billion booby-trapped emails and text messages of this kind have been sent since January 2026 from the tools of a single Chinese-speaking phishing ecosystem. They targeted more than 75,000 organizations worldwide.

On October 14, the company announced it had disrupted this ecosystem, together with law enforcement and several private partners. Who is behind these messages, and what could be taken from them?

One marketplace and three turnkey kits

Microsoft distinguishes two groups. The first, which it calls Storm-3119, runs YAM Store. This underground marketplace resells compromised or fraudulently obtained Microsoft and Google environments: accounts, licenses, domain names and storage space. The second, Storm-2990, brings together the developers of three phishing kits sold as a service: CoGUI, Haozi and Iron Man System. Offered since June 2026, Iron Man includes more than 2,335 fake page templates covering more than 139 countries, according to Microsoft.

The lures imitate local government agencies, fine or parking services, delivery companies, banks and major brands. To evade analysts, the kits filter visitors (geolocation, fake CAPTCHAs, IP address lists). They also let the operator track the victim in real time.

The backdrop, meanwhile, was supplied by the cloud. Microsoft explains that Storm-3119 created fake organizations, probably using AI-generated content and forged documents, to open cloud environments that looked legitimate. The group then hijacked SharePoint and OneDrive storage to host its pages.

Domains seized, no known arrests

The investigation began with reports from the Japanese national police. Resecurity, Cloudflare, Proofpoint and TRM Labs, among others, took part. According to BleepingComputer, a federal court order in Florida allowed Microsoft and Health-ISAC, the health sector's information-sharing organization, to seize and redirect domains tied to YAM Store, CoGUI and Iron Man.

Microsoft has disabled more than 20,000 accounts linked to YAM Store and is blocking more than 100,000 spoofing domains. The takedown of other infrastructure is continuing. As for the perpetrators, however, the sources consulted report no arrests.

Good habits to adopt

Microsoft does not name France among the targeted countries: Japan, the United States, Australia and India are named. But these kits are sold to any buyer, and their scenarios resemble the fake fine or delivery texts familiar to people in France. Microsoft's recommendations therefore apply to all organizations:

• verify any urgent request by contacting the organization through a known channel;
• switch to phishing-resistant authentication, such as passkeys, at least for privileged accounts;
• lock down global administrator roles by applying the principle of least privilege;
• allow new authentication methods to be registered only from trusted devices and locations.

The first habit also applies to fake phone calls. One hacker claims to hold 10.3 million lines of customer data from Solutions30, a subcontractor of Orange and Enedis, with no confirmation so far, which could make fake fiber or Linky technician calls sound credible.